search

owasp-modsecurity / ModSecurity

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.
https://www.modsecurity.org
Apache License 2.0
8.31k stars 1.61k forks source link

Building from (Which) Source. Compilation recipe's instructions using outdate (SpiderLabs) URL's. On Purpose? #3276

Open Danrancan opened 1 month ago

Danrancan commented 1 month ago

I am trying to build the Modsecurity Module as a dynamic module for Nginx, on Ubuntu 22.04.

On THIS PAGE https://github.com/owasp-modsecurity/ModSecurity/wiki/Compilation-recipes-for-v3.x#ubuntu-2210 . Under the "Ubuntu 22.10" --> libModSecurity" section, it shows the following:

$ sudo apt-get install git g++ apt-utils autoconf automake build-essential libcurl4-openssl-dev libgeoip-dev liblmdb-dev libpcre2-dev libtool libxml2-dev libyajl-dev pkgconf zlib1g-dev
$ git clone https://github.com/SpiderLabs/ModSecurity

Shouldn't we be downloading from the new the source (Master) repository from from "Owasp-Modsecurity" like this:

$ sudo apt-get install git g++ apt-utils autoconf automake build-essential libcurl4-openssl-dev libgeoip-dev liblmdb-dev libpcre2-dev libtool libxml2-dev libyajl-dev pkgconf zlib1g-dev
$ git clone https://github.com/owasp-modsecurity/ModSecurity.git

I am trying to build the submodule and libmodsecurity from source and need to know which repository I should be building from. Please let me know. Thanks.

airween commented 1 month ago

Hi @Danrancan,

thanks for noticing this!

You're right, everyone should use "owasp-modsecurity" organization. I've changed all occurrences of "SpiderLabs" to "owasp-modsecurity". Luckily, Github redirects the client to the new URL.

I am trying to build the submodule and libmodsecurity from source and need to know which repository I should be building from. Please let me know. Thanks.

Those (submodules) are also available from the mentioned repository.

Btw, if you don't want to compile your module (it's not as simple in case of Ubuntu 22.04), you could take a look at this repository: https://modsecurity.digitalwave.hu.

Danrancan commented 1 month ago

Hi @Danrancan,

thanks for noticing this!

You're right, everyone should use "owasp-modsecurity" organization. I've changed all occurrences of "SpiderLabs" to "owasp-modsecurity". Luckily, Github redirects the client to the new URL.

I am trying to build the submodule and libmodsecurity from source and need to know which repository I should be building from. Please let me know. Thanks.

Those (submodules) are also available from the mentioned repository.

Btw, if you don't want to compile your module (it's not as simple in case of Ubuntu 22.04), you could take a look at this repository: https://modsecurity.digitalwave.hu.

Thanks for the clarification. And actually, I compiled Modsecurity and libmodescurity3 quite easily on Ubuntu 22.04 Mainline for Raspberry Pi. Is there a way I can contribute my compiled binary to the unnofficial repository https://modsecurity.digitalwave.hu/ that you mentioned?

airween commented 4 weeks ago

Hi @Danrancan,

sorry for the late reply, I was sure I answered this :)

Thanks for the clarification. And actually, I compiled Modsecurity and libmodescurity3 quite easily on Ubuntu 22.04 Mainline for Raspberry Pi. Is there a way I can contribute my compiled binary to the unnofficial repository https://modsecurity.digitalwave.hu/ that you mentioned?

Well, it would be fine to cover all of supported operation systems (Debian 11/12, Ubuntu 20.04/22.04/24.06), even if only you want to add this package alone (but it would only make sense if you/we add the connector to Nginx).

It would be too much work to add a new architecture for only one distribution's one release, and for one package. But if you want to set up an own repository, feel free to ask!